Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency cooldowns turn you into a free-rider

calpaterson.com

Post reply on HN
Print view View original

101–110 of 131 posts

Re: Dependency cooldowns turn you into a free-rider

#101

Post by LtWorf »

vlovich123 wrote: post #16
bnjemian wrote: post #9

Okay sure, but what happens when a high CVE is discovered that requires immediate patching – does that get around the Upload Queue? If so, it's possible one could opportunistically co-author the patch and shuttle in a vulnerability, circumventing the Upload Queue. If you instead decide that the Upload Queue can't be circumvented, now you're increasing the duration a patch for a CVE is visible. Even if the CVE disclos…

This literal example is actually addressed by the Debian example - the security team has powers to shuttle critical CVEs through but it’s a manual review process. There’s a bunch of other improvements they call out like automated scanners before distribution and exactly what changed between two distributed versions. The only oversight I think in the proposal is staggered distributions so that projects declare a UUID…

But the whole point of using pypi and npm is because distributions are a thing that only old graybeard boomers use.

Re: Dependency cooldowns turn you into a free-rider

#102

Post by codebje »

weinzierl wrote: post #94
dominicq wrote: post #18

> Fundamental in the dependency cooldown plan is the hope that other people - those who weren't smart enough to configure a cooldown - serve as unpaid, inadvertent beta testers for newly released packages. This is wrong to an extent. This plan works by letting software supply chain companies find security issues in new releases. Many security companies have automated scanners for popular and less popular libraries, w…

"This plan works by letting software supply chain companies find security issues in new releases." If it was that easy we'd simply find all vulnerabilities before the release. If the supply chain companies can run the scanners you can (and should) run them too. Even if we assume there is more to it, it would make sense to let those companies do the work before GA. But it is not that easy. The true value comes from ma…

Consumers of dependencies aren't necessarily - or, I would argue, even typically - eyeballing them. The eye ballers in practice seem to mostly be hackers. Skipping the cooldown doesn't mean you're contributing eyes, it means you're volunteering to help the news of how many victims the attack swept up bigger.

No-one is hurt by having the cooldown. Hackers could choose to also have a cooldown, but must balance the risk of competing groups exploiting vulnerabilities first against the reward of a bigger pool of victims to exploit, and without collusion that still favours early exploits over held ones.

Re: Dependency cooldowns turn you into a free-rider

#103

Post by skeeter2020 »

johnny22 wrote: post #72
endymi0n wrote: post #46

Earlier quoted context omitted.

Welcome to npm post-install scripts... https://docs.npmjs.com/cli/v11/using-npm/scripts

glad pnpm disables those by default!

PSA: if you're using (a newish release of) npm you should have something like this as a default, unless you've got good reasons not to:

min-release-age=7 # days

ignore-scripts=true

Re: Dependency cooldowns turn you into a free-rider

#104

Post by LtWorf »

p0w3n3d wrote: post #20

It keeps me thinking that every company loves "those guys" who create OpenSource but won't give them a broken penny, nor support them in any other way Servants! Just do your open source magic, We're impatient! Ah and thanks for all the code, our hungry hungry LLMs were starving.

Which is why those guys should really stick to using copyleft licenses only, possibly just AGPL.

Re: Dependency cooldowns turn you into a free-rider

#105

Post by skeeter2020 »

8cvor6j844qw_d6 wrote: post #17

Not everyone has the same update cycle. That's not free-riding. The framing around not being on the latest version as irresponsible doesn't hold up.

It feels like the argument being made is you're a freerider if you don't adhere to the same million miles per hour frenzy that got us into this problem in the first place. The author probably also feels deploying from private repos with OS dependencies is wrong because that's the domain of the ultra-rich 1%

Re: Dependency cooldowns turn you into a free-rider

#106

Post by LtWorf »

duskdozer wrote: post #78
p0w3n3d wrote: post #20

It keeps me thinking that every company loves "those guys" who create OpenSource but won't give them a broken penny, nor support them in any other way Servants! Just do your open source magic, We're impatient! Ah and thanks for all the code, our hungry hungry LLMs were starving.

As much as I think what you say in general holds, there's at least something against it here: >And the PSF even recently took in $1.5m from Anthropic for, among other things: supply-chain security.

Yes they took money that they have to spend in AI to evaluate the new uploads.

Basically they got some free tokens, not actual "money".

Also I got a 2 week ban on the python discuss for suggesting that people who contribute on behalf of companies (such as microsoft) should be disclosing it. So PSF is as corporate as it gets in my eyes.

Re: Dependency cooldowns turn you into a free-rider

#107

Post by skeeter2020 »

zarzavat wrote: post #87

This is not true. Attackers are usually not publishing packages under their own accounts. They are publishing packages using hacked accounts of major packages that have many dependants. The real owner will (hopefully) notice when a malicious version is published. If you use a cooldown then it gives the real owner of the account enough time to report the hack and get the malicious version taken down.

we tend to find to types of compromised packages: 1. the type you describe; literally published with stolen creds while the owner sleeps, and found the next day. 2. packages will malware found months or years after the fact, while everyone happily goes about their day. Cool-downs of only a few days basically solve the first, while neither of these solves the second.

Re: Dependency cooldowns turn you into a free-rider

#108

Post by cush »

It’s hard to piece together what the actual proposal is around all of the hyperbole, strawmanned arguments, and emotional language. It more or less claims Upload Queues solve all of the problems without explaining any of the how… Then it suddenly shifts to “executing markdown” because LLMs?

Is the idea I’d point my security scanner at preview.registry.npmjs.org/ and npmjs.org would wait 7 days before the package would publish on the main registry?

Re: Dependency cooldowns turn you into a free-rider

#109

Post by [deleted] »

thaumasiotes wrote: post #71
suzzer99 wrote: post #44

Earlier quoted context omitted.

Yeah this. If I don't buy the new iPhone XX.0 but instead wait for XX.1, which could include software and hardware fixes, does that make me a free rider?

> If I don't buy the new iPhone XX.0 but instead wait for XX.1, which could include software and hardware fixes, does that make me a free rider? Yes, that's what free-riding is. And the major problem, which the article touches on but doesn't do much to explore, is that if you characterize this as "responsible behavior", it will automatically cause itself to fail, because all of the benefits come from free-riding. The…

[deleted]

Re: Dependency cooldowns turn you into a free-rider

#110

Post by groby_b »

They are also collectively rational, as a response to an ecosystem that's spun out of control and habitually consumes rats nests of dependencies.

Early participation and beta programs are outsourcing careful engineering via making everybody else guinea pigs. If we want to sling around accusations of free-riding (really?!), you're slacking on testing and free-riding on your early users.

Post reply on HN